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IN THE CLAIMS: 
Amended claims follow: 

1 . (Currently Amended) A method for establishing a list of security 
scanner attributes for a computing node within a hierarchy of computing nodes, 
the list of security scanner attributes being associated with a security scanner 
action to be performed by a security- scanner program, the method comprising: 

establishing a hierarchy of lists of attributes, an attribute being comprised 
of an attribute identifier and an attribute value, the attribute value being comprised 
of either-a list of attributes or a controlling valu e used by the security scanner 
program to control an operation of the security scanner program, the list of 
attributes being comprised of a grouping attribute and a series of one or more 
attributes; 

examining the grouping attribute associated with the list of attributes; 

updating an element of the list of attributes if the grouping attribute 
indicates that the element may be updated without also updating other elements in 
the list of attributes; 

updating the element and all other elements of the list of attributes if the 
grouping attribute indicates that updating the element requires all other elements 
to be updated; and 

updating the element, all other elements, and all subordinate elements of 
the list of attributes if the grouping attribute indicates that updating the element 
requires all subordinate elements of the list of attributes to be updated; 

wherein the grouping attribute is associated with the entire list of attributes 
for controlling the updating through selection of at least one of at least three 
scenarios by indicating at least one of: 
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the element may be updated without also updating other elements 
in the list of attributes. 

updating the element requires all other elements in the list of 
attributes to be updated, and 

updating the element requires all other elements in the list of 
attributes and all subordinate elements in the list of attributes, to be 
updated; 

wherein updating the element involves overwriting the value with another 
value that may be identical to an original value; 

wherein updating the element and all other elements of the list of attributes 
involves overwriting each value with another value that may be identical to an 
original value; 

wherein updating the element, all other elements in the list of attributes, 
and all subordinate elements of the list of attributes involves overwriting each 
value with another value that may be identical to an original value for each 
element and each subordinate element of the list of attributes; 

wherein the attribute value includes a second list of attributes used by the 
security scanner program to control the operation of the security scanner program; 

wherein the second list of attributes includes a second grouping attribute 
associated with each of the attributes of the second list^ 

wherein the element of the list of attributes contains an identifier that 
uniauelv identifies the element and a value, wherein the value may itself be a list 
of elements . 

2.-6, (Cancelled) 
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7. (Currently Amended) The method of claim 3L wherein if the 
attribute being updated is itself another list of attributes, the grouping attribute can 

indicate one of: 

the attribute can be updated; 

a content of the list of attributes can be replaced; and 

the other list of attributes can be merged with the list of attributes. 

8. (Original) The method of claim 1 , wherein the security scanner 
program performs a scanning process on files associated with the computing node 
for malicious computer instructions, wherein details of the scanning process are 
specified by the list of security scanner attributes. 

9. (Currently Amended) A computer-readable storage medium storing 
instructions that when executed by a computer causes the computer to perform a 
method for establishing a list of security scanner attributes for a computing node 
within a hierarchy of computing nodes, the list of security scanner attributes being 
associated with a security scanner action to be performed by a security scanner 
program, the method comprising: 

establishing a hierarchy of lists of attributes, an attribute being comprised 
of an attribute identifier and an attribute value, the attribute value being comprised 
of either-a list of attributes or a controlling valu e-used by the security scanner 
program to control an operation of the security scanner program, the list of 
attributes being comprised of a grouping attribute and a series of one or more 
attributes; 

examining the grouping attribute associated with the list of attributes; 

updating an element of die list of attributes if the grouping attribute 
indicates that the element may be updated v^thout also updating other elements in 
the list of attributes; 
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updating the element and all other elements of the list of attributes if the 
grouping attribute indicates that updating the element requires all other elements 
to be updated; and 

updating the element, all other elements, and all subordinate elements of 
the list of attributes if the grouping attribute indicates that updating the element 
requires all subordinate elements of the list of attributes to be updated; 

wherein the grouping attribute is associated with the entire list of attributes 
for controlling the updating through selection of at least one of at least three 
scenarios by indicating at least one of: 

the element may be updated without also updating other elements 
in the list of attributes, 

updating the element requires all other elements in the list of 
attributes to be updated, and 

updating the element requires all other elements in the list of 
attributes and all subordinate elements in the list of attributes to be 
updated; 

wherein updating the element involves overwriting the value with another 
value that may be identical to an original value; 

wherein updating the element and all other elements of the list of attributes 
involves overwriting each value with another value that may be identical to an 
original value; 

wherein updating the element, all other elements in the list of attributes, 
and all subordinate elements of the list of attributes involves overwriting each 
value v^th another value that may be identical to an original value for each 
element and each subordinate element of the list of attributes; 

wherein the attribute value includes a second list of attributes used by the 
security scanner program to control the operation of the security scanner program; 
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wherein the second list of attributes includes a second grouping attribute 
associated with each of the attributes of the second list; 

wherein the element of the list of attributes contains an identifier that 
uniQueiv identifies the element and a value, wherein the value m av itself be a list 
of elements . 

10.-14. (Cancelled) 

15. (Currently Amended) The computer-readable storage medium of 
claim 409, wherein if the attribute being updated is itself another list of attributes, 
the grouping attribute can indicate one of: 

the attribute can be updated; 

a content of the list of attributes can be replaced; and 

the other list of attributes can be merged with the list of attributes. 

1 6. (Original) The computer-readable storage medium of claim 9, 
wherein the security scanner program performs a scanning process on files 
associated with the computing node for malicious computer instructions, wherein 
details of the scanning process are specified by the list of security scanner 
attributes. 

1 7. (Currently Amended) An apparatus that facilitates establishing a 
list of security scanner attributes for a computing node within a hierarchy of 
computing nodes, the list of security scanner attributes being associated with a 
security scanner action to be performed by a security scanner program, 
comprising: 

an establishing mechanism that is configured to establish a hierarchy of 
lists of attributes, an attribute being comprised of an attribute identifier and an 
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attribute value, the attribute value being comprised of e ither a list of attributes ef^ 
oontrolling value used by the security scanner program to control an operation of 
the security scanner program, tlie list of attributes being comprised of a grouping 
attribute and a series of one or more attributes; 

an examining mechanism that is configured to examine the grouping 
attribute associated with the list of attributes; 

an updating mechanism that is configured to update an element of the list 
of attributes if the grouping attribute indicates that the element may be updated 
without also updating other elements in the list of attributes; 

wherein the updating mechanism is further configured to update the 
element and all other elements of the list of attributes if the grouping attribute 
indicates that updating the element requires all other elements to be updated; and 

wherein the updating mechanism is further configured to update the 
element, all odier elements, and all subordinate elements of the list of attributes if 
the grouping attribute indicates that updating the element requires all subordinate 
elements of the list of attributes to be updated; 

wherein the grouping attribute is associated with the entire list of attributes 
for controlling the updating through selection of at least one of at least three 
scenarios by indicating at least one of: 

the element may be updated without also updating other elements 

in the list of attributes, 

updatmg the element requires all other elements in the list of 

attributes to be updated, and 

updating the element requires all other elements in the list of 

attributes and all subordinate elements in the list of attributes to be 

updated; 

wherein updating the element involves overwriting the value with another 
value that may be identical to an original value; 
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wherein updating the element and all other elements of the list of attributes 
involves overwriting each value with another value that may be identical to an 
original value; 

wherein updating the element, all other elements in the list of attributes, 
and all subordinate elements of the list of attributes involves overwriting each 
value with another value that may be identical to an original value for each 
element and each subordinate element of the list of attributes; 

wherein the attribute value includes a second list of attributes used by the 
security scanner program to control the operation of the security scanner program; 

wherein the second list of attributes includes a second grouping attribute 
associated with each of the attributes of the second list; 

wherein the element of the list of attributes conta ins an identifier that 
uniquely identifies the element and a value> wh erein the value may itself be a list 
of elements . 

18.-22. (Cancelled) 

23. (Currently Amended) The apparatus of claim 4*17> wherein if the 
attribute being updated is itself another list of attributes, the grouping attribute can 
indicate one of: 

the attribute can be updated; 

a content of the list of attributes can be replaced; and 

the other list of attributes can be merged with the list of attributes. 

24. (Original) The apparatus of claim 17, vs^herein the security scanner 
program is configured to perform a scanning process on files associated with the 
computing node for malicious computer instructions, wherein details of the 
scanning process are specified by the list of security scanner attributes. 
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25.-26. (Cancelled) 

27. (New) The method of claim 1 , wherein the list of security scanner 
attributes determines the files to be scanned by the security scanner program. 

28. (New) The method of claim 27, wherein the list of security scanner 
attributes further determines a corrective action to take in response to the 
identification of an infected file. 
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